Notice of Privacy Practices

01Who this Notice covers

This Notice is issued by [MEDICAL GROUP NAME] and its affiliated independent physician-owned professional entities ("the Practice," "we," "us"), which together operate as an Organized Health Care Arrangement for the purposes of HIPAA. It applies to all clinicians, staff, trainees, and workforce members of the Practice.

Reborn RX LLC provides administrative, technology, and support services to the Practice and acts as a HIPAA Business Associate under a written agreement that requires it to protect your information on the same terms described in this Notice.

Dispensing pharmacies and laboratories are separate covered entities with their own notices, which they provide to you directly.

02Our legal duties

Federal and state law require us to:

• Maintain the privacy and security of your protected health information (PHI);
• Give you this Notice of our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect;
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI; and
• Obtain your written authorization for uses and disclosures not described in this Notice, and honor a revocation of that authorization.

03How we may use and disclose your information without your authorization

For treatment

We use your health information to provide, coordinate, and manage your care. For example, your clinician reviews your intake and lab results to decide whether NAD+ is appropriate, transmits a prescription to a pharmacy, and shares relevant history with a covering clinician or a specialist to whom you are referred.

For payment

We use and disclose your health information to bill and collect payment. For example, we may share the minimum necessary information with your health plan to obtain a prior authorization, verify coverage, or appeal a denial.

For health care operations

We use your health information to run the Practice and improve care quality. Examples include peer review and clinical quality assessment, credentialing and evaluating clinician performance, training, care management and outreach, audits, accreditation, and business planning. We use the minimum information necessary for these purposes.

Business Associates

We share information with vendors that perform services for us — electronic health record hosting, secure messaging, laboratory interfaces, e-prescribing, billing, and customer support. Each is bound by a Business Associate Agreement requiring safeguards equivalent to ours.

04Other permitted or required uses and disclosures

The law permits or requires us to use or disclose your information without your authorization in the following circumstances:

Appointment reminders, treatment alternatives, and health-related benefits

To contact you about appointments, refills, check-ins, and treatment options relevant to your care.

Individuals involved in your care

To a family member, friend, or caregiver you identify, limited to information directly relevant to their involvement. If you are present and able to agree, we will ask first. If you are incapacitated, we will use professional judgment and disclose only what is in your best interest.

Required by law

Where federal, state, or local law compels disclosure.

Public health activities

To prevent or control disease; to report births and deaths; to report adverse events, product defects, and problems with medications to the FDA or to a manufacturer; and to notify persons who may be at risk of contracting or spreading a disease.

Abuse, neglect, or domestic violence

To a government authority authorized to receive such reports.

Health oversight

To agencies conducting audits, investigations, inspections, and licensure actions.

Judicial and administrative proceedings

In response to a court order, or to a subpoena or discovery request where satisfactory assurances of notice to you or a protective order have been provided.

Law enforcement

In limited circumstances, such as responding to a court order or warrant, identifying a suspect or missing person, or reporting a crime on our premises.

Serious threat to health or safety

To prevent or lessen a serious and imminent threat to you or the public.

Workers' compensation, military, national security, and correctional institutions

As authorized by law.

Coroners, medical examiners, funeral directors, and organ procurement

As authorized by law.

Research

Where an institutional review board or privacy board has approved a waiver of authorization, or where information has been de-identified.

05Uses that always require your written authorization

We will obtain your written authorization before:

• Most marketing communications that involve payment from a third party;
• Any sale of your protected health information — we do not sell PHI;
• Disclosure of psychotherapy notes, except in narrow circumstances permitted by law;
• Most disclosures of substance use disorder treatment records protected under 42 CFR Part 2; and
• Any other use or disclosure not described in this Notice.

You may revoke an authorization at any time in writing. Revocation stops future uses and disclosures but does not undo actions already taken in reliance on it. Certain state laws give additional protection to information about HIV status, mental health, reproductive health, and substance use, and we follow the more protective standard where it applies.

06Your rights regarding your health information

Right to inspect and copy

You may inspect and obtain a copy of your medical and billing records, including an electronic copy where we maintain them electronically. We will respond within 30 days and may charge a reasonable, cost-based fee. We may deny access in limited circumstances, and some denials are subject to review by a licensed professional.

Right to amend

If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it. We may deny the request if the record was not created by us, is not part of the designated record set, or is accurate and complete — in which case you may submit a statement of disagreement that will be included in your record.

Right to an accounting of disclosures

You may request a list of certain disclosures we made in the six years before your request, excluding disclosures for treatment, payment, and operations and those you authorized. One accounting per 12-month period is free.

Right to request restrictions

You may ask us to restrict how we use or disclose your information. We are not required to agree, except that we must agree to withhold information from a health plan where you have paid for the item or service in full out of pocket.

Right to confidential communications

You may ask us to contact you by a particular method or at a particular address — for example, only by secure message and never by mail. We will accommodate reasonable requests and will not ask you why.

Right to a paper copy of this Notice

You may request a paper copy at any time, even if you agreed to receive it electronically.

Right to breach notification

You will be notified if a breach compromises the privacy or security of your unsecured PHI.

Right to choose someone to act for you

A personal representative with legal authority, such as a health care power of attorney, may exercise these rights on your behalf after we verify that authority.

To exercise any right, contact our Privacy Officer using the details in Section 8.

07How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us and with the federal government. We will not retaliate against you, and your care will not be affected in any way.

With us

Privacy Officer, [MEDICAL GROUP NAME], P.O. Box 8130, Fayetteville, AR 72717 · info@rebornrx.health · 1-877-671-5767

With the federal government

U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201 · 1-800-368-1019 (TDD 1-800-537-7697) · hhs.gov/ocr/complaints. A complaint must generally be filed within 180 days of when you knew of the act.

08Effective date and changes to this Notice

This Notice is effective August 18, 2026. We reserve the right to change it and to make the revised Notice effective for all information we already maintain as well as information we receive in the future. The current Notice will always be posted on this page with its effective date, and we will notify you of material changes.